75481 matches found
PT-2026-76940
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists in the GraalVM JavaScript sandbox allowlist enforcement due to the use of unescaped regular expressions when validating package names. Users with trigger creation privileges can...
CVE-2026-52609
A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...
CVE-2026-52606
The software reportico-web (version
CVE-2026-74976: Access of Resource Using Incompatible Type
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...
CVE-2026-74937: Use After Free
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
CVE-2026-74938: Protection Mechanism Failure
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
PT-2026-77009
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A JIT miscompilation...
CVE-2026-74938: Protection Mechanism Failure
Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
CVE-2026-74984: Concurrent Execution using Shared Resource with Improper Synchronization
Race condition in the JavaScript Engine component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
KLA91229 Multiple vulnerabilities in Mozilla Thunderbird
Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability in t...
CVE-2026-75531
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-75531
Pandora's URL observable rendering embeds attacker-controlled URLs inside an inline JavaScript onclick handler despite HTML escaping, allowing script breakout and execution in a victim's authenticated session. The fix removes the value from the inline handler, stores it in a data-url attribute, a...
CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
EUVD-2026-60465
Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...
CVE-2026-47683
creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:16+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9...
GHSA-V5X7-VHWF-5V44 vulnerabilities
Vulnerabilities for packages: firefox...
CVE-2026-47698
creationtimestamp| type| source ---|---|--- 2026-08-17 20:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcjmnli3k24 2026-08-17 20:35:07+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj 2026-08-17 22:08:18+00:0...